Harden private networking, add optional AMPLS, and refresh network diagrams

[Paul Lizer (paullizer)]

Summary

• Fix Redis private endpoints in Bicep/AZD, Commercial Video Indexer DNS, and Government Key Vault DNS across deployers. Redis public access closes after bootstrap in the final azd up hook.
• Add default-off AMPLS for Commercial and Government through Bicep/AZD, Terraform, and Azure CLI, with private-only monitoring and existing DNS-zone reuse. Handle Government's additional ADX zone outside the five-zone PE DNS group.
• Update both Visio artifacts with ACR, Key Vault, platform networking, compact subnet sizing, monitoring DNS, and cloud-specific Redis/service labels. Add a diagram companion and fresh-versus-existing-network subnet tables.
• Update release notes for application 0.261.333 and deployer 1.0.34. Regenerate previously stale release pages, preserving all 304 release sections and splitting oversized 0.261 notes into seven pages.

Linked issue

Refs #1765

Branch target

This branch was created from paullizer-react-v2-ui and targets that same branch, as requested. It does not target main and does not include the parent branch's unrelated V2 work in its diff.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Visible to end users: No new runtime UI. Admin-facing: Yes, deployment/configuration and architecture guidance.
Latest Feature card: Not added; this is deployment opt-in functionality. Screenshot/card image: Not needed. Updated Visio sources are included under artifacts/.

Version bump

• Application patch bumped to 0.261.333.
• Deployer patch bumped to 1.0.34.

Testing / validation

• 19 tests passed: test_azd_private_dns_zone_config_wiring.py, test_video_indexer_deployment_region_permissions.py, and test_azd_prerequisites_allowed_ip_auto_merge.py. One pre-existing pytest return-value warning remains.
• Bicep compilation passed; both generated ARM templates match fresh builds.
• Terraform 1.12.2 validation passed against locked providers, with no backend or cloud provisioning; networking formatting check passed.
• All four Windows AZD hooks and the CLI script parse; mocked CLI checks cover invalid combinations, failed/successful AMPLS setup, and existing endpoint DNS reconciliation.
• Documentation surface coverage: 7/7. Documentation site quality: 6/6.
• Release history integrity passed for all 304 sections; release-note generator --check passed.
• Staged whitespace checks passed. Python syntax compilation passed.

Documentation

• Release notes updated and generated pages synchronized.
• Feature and fix documentation updated.
• Commercial and Government tables distinguish fresh script defaults (one shared endpoint subnet) from the segmented compact existing-network reference.
• Both artifacts/architecture.vsdx and artifacts/private_endpoints.vsdx included, covering ACR, Key Vault, and the wider architecture updates.

Security checklist

• No new Flask routes or frontend settings payloads; route Swagger/sanitization requirements are not applicable.
• No browser runtime assets or CDN dependencies added.
• No credentials, keys, connection strings, temporary validator binaries, or local environment files included.
• AMPLS is default off; its shared-DNS impact and private client reachability requirements are documented.

Review Notes And Remaining Validation

• No live Azure resources were provisioned or changed. Verify DNS, Redis connectivity, telemetry ingestion, and monitoring queries in the intended Commercial/Government environment.
• Government's Visio page still contains the Commercial Video Indexer private-zone label. Review/correct that diagram label; the implementation and docs intentionally do not provision a Government Video Indexer PE under the supported API profile.
• azd provision / azd deploy alone do not run postup; separate workflows need equivalent final Redis lockdown. Reprovisioning resets Managed Redis bootstrap access until lockdown runs again.
• Existing-VNet reuse accepts one shared endpoint subnet; the five-subnet compact reference requires explicit enterprise endpoint placement/customization.